How to start with Android Enterprise Corporate owned dedicated devices in Microsoft Intune

The last two blog articles I wrote about Android Enterprise and I showed how to start with Work profiles and Corporate owned fully managed user devices. The third management mode is Corporate owned dedicated devices. This mode is used for dedicated devices which are fully managed, but not assigned to a user. Those devices are used for a single purpose, like ticket printing for example.

To get started with Android Enterprise Corporate owned dedicated devices, your managed Google Play account needs to be connected with your Intune tenant. If you want to see the steps which needs to be taken to connect Intune with Google play, see my previous blog.

In this blog post I will shows the steps to get started with Android Enterprise Corporate owned dedicated devices. The steps involved are creating an enrollment profile, a dynamic security group, a device restrictions policy (optional) and approving and assigning Google Play apps.

Create an enrollment profile

The first configuration step we need to take is creating an enrollment profile. When we create an enrollment profile, a token and QR Code are generated which we need to use to enroll the Android devices in to Intune.

1. Open the Device Management Portal and click Device enrollment
2. Click Android enrollment
3. Click Corporate-owned dedicated devices

Click Create Profile

1. Give the profile a Name
2. Give the profile a Description (Optional)
3. If required change the Token expiration data (Optional)
4. Click Create

When the profile is created, click the Token tab. Here you will find the token and QR Code, you need during enrollment.

Create dynamic security group

To assign configuration policies and apps to a group of dedicated Android devices, we can make use of a dynamic security group. We can create a group with group membership based on the enrollment profile name we just created at the previous step. Devices enrolled as corporate owned dedicated device are automatically added to this group en receive the assigned policies and apps.

1. Click Azure Active Directory – Groups
2. Click New group
3. Choose Security as group type
4. Give the security group a Name
5. Give the group a Description (Optional)
6. Choose Dynamic device as Membership type
7. Click the Add dynamic query tab
8. Choose enrollmentprofilename in the first drop down list below Add device where
9. Choose match from the second drop down list
10. In the third field enter the enrollment profile name
11. Click Add query – click Create

Create a device restrictions policy

Creating and assigning a device restrictions policy is optional when using dedicated Android devices as those devices are already locked down by default. But I want to restrict at least the option to perform a factory reset by using a restriction policy.

1. Click Device configuration – Profiles
2. click Create profile

1. Give the configuration profile a Name
2. Give the profile a Description (Optional)
3. Choose Android Enterprise as Platform
4. Choose Device owner only – Device restrictions as Profile type

Now configure all the settings you want to apply to your dedicated devices. I set Factory reset as Block. Another setting might be for example blocking the camera.
When finished the configuration click OK twice and click Create.

1. Click the Assignments tab
2. Search for the previously created security group and add it
3. Click Save

Approve and assign Android applications

The last step in our configuration is approving and assiging Android applications to our dedicated devices.

1. Click Client apps – Apps
2. Click Add

1. Choose Managed Google Play as App type
2. Click the Managed Google Play (Approve) tab
3. Search for the required app and click on the app, in the case Microsoft Edge

Click the green Approve button (sorry for the Dutch print screens)

Click Approve

Click Save

Click OK

Click Sync

After a few seconds the approved app is available in the list with apps in Intune.

1. Click the approved app
2. click the Assignments tab
3. Click Add group
4. Select Required as Assignment type
5. On the Include tab search for the security group and select the group
6. click OK twice and click Save

Device enrollment experience

Now let`s have a look at how the enrollment looks like when we enroll an Android device as dedicated device.

Some of the screens below might look different to what you will see, or you will see some extra screens. That depends on the Android OS version and supplier. For example I got to accept some terms and conditions from Motorola on my test device.

After starting your Android device, tab 7 times on the screen at a white space. It will start the QR code setup which needs you to connect to a Wi-Fi network. After connecting to a Wi-Fi network, the QR Code Reader will be installed.

When the installation of the QR Code Reader is finished, scan the QR Code which we have created in the Device Management Portal under Android enrollment, Corporate owned dedicated devices. This will start the device enrollment.
Click Encrypt.

You will be redirected to Settings of the device. Encrypt your device and after encrypton is finished, setup continues.
Click OK.

Set up work device.
setting the device owner…

Updating device…
Downloading Google Play store

Registering device…
Applying your organizations`s policies.

When the policies are applied , you are logged on to the device and it shows the home screen. After installation the required app is shown on the home screen next to some default apps.

As you can see only some default apps are available besides the assigned (required) app Edge.
The Device Policy app is installed as part of the enrollment and performs the communication with Intune.

As I set in the device restrictions policy, factory reset is blocked (greyed out).

A next step in creating Android dedicated devices is creating a kiosk style device, which further locks down the Android devices. A kiosk style device can be setup to only allow a single-app or multiple apps. In a next blog I will show the configurations steps for such a device.